# Critical Kyverno Vulnerability -- CVE-2026-54523

DevFeed: [Critical Kyverno Vulnerability -- CVE-2026-54523](<https://devfeed.tech/articles/critical-kyverno-vulnerability-cve-2026-54523-17651.md>)

Original publisher: [Read original article](<https://nirmata.com/2026/07/28/critical-kyverno-vulnerability-cve-2026-54523/>)

Author: Anubhav Sharma

Published: 2026-07-29T01:08:41Z

Content type: news

Language: en

Sources: [Nirmata](<https://devfeed.tech/sources/nirmata.md>)

Topics: [Kyverno](<https://devfeed.tech/topics/kyverno.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [Exploit](<https://devfeed.tech/topics/exploit.md>), [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [Cloud Native Ecosystem](<https://devfeed.tech/topics/cloud-native-ecosystem.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [admission-controller](<https://devfeed.tech/tags/admission-controller.md>), [ai](<https://devfeed.tech/tags/ai.md>), [cloud-native](<https://devfeed.tech/tags/cloud-native.md>), [cloud-native-ecosystem](<https://devfeed.tech/tags/cloud-native-ecosystem.md>), [cncf](<https://devfeed.tech/tags/cncf.md>), [cve](<https://devfeed.tech/tags/cve.md>), [devsecops](<https://devfeed.tech/tags/devsecops.md>), [engineering](<https://devfeed.tech/tags/engineering.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [kyverno](<https://devfeed.tech/tags/kyverno.md>), [nctl-ai](<https://devfeed.tech/tags/nctl-ai.md>), [platform-engineering](<https://devfeed.tech/tags/platform-engineering.md>), [policy](<https://devfeed.tech/tags/policy.md>), [policy-as-code](<https://devfeed.tech/tags/policy-as-code.md>), [policy-management](<https://devfeed.tech/tags/policy-management.md>), [release](<https://devfeed.tech/tags/release.md>), [upgrade](<https://devfeed.tech/tags/upgrade.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

The article reports CVE-2026-54523, a critical Kyverno vulnerability affecting versions 1.18.0 and 1.18.1. A tenant able to create a NamespacedMutatingPolicy could bypass namespace isolation and generate resources in other namespaces, potentially enabling cluster-wide privilege escalation. Kyverno 1.18.2 patches the vulnerability.

## Source excerpt

Critical Kyverno Vulnerability -- CVE-2026-54523 On July 13, 2026, a critical vulnerability was disclosed in Kyverno, the Kubernetes-native policy engine used broadly across the cloud native ecosystem for policy-as-code enforcement. The vulnerability, tracked as CVE-2026-54523 (GHSA-79gf-7frw-68m9), allows a tenant with permission to create a NamespacedMutatingPolicy... The post Critical Kyverno Vulnerability -- CVE-2026-54523 first appeared on Nirmata.